{"record":{"id":"6c6e87d08bdeb72e","repo":"sveltejs/kit","slug":"invalid-field-name-path-field-names-are-writte","errorCode":null,"errorMessage":"Invalid field name ${path}: field names are written in JS object notation, so keys that would need quoting are not supported. See https://svelte.dev/docs/kit/remote-functions#form-Fields","messagePattern":"Invalid field name (.+?): field names are written in JS object notation, so keys that would need quoting are not supported\\. See https://svelte\\.dev/docs/kit/remote-functions#form-Fields","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/kit/src/runtime/form-utils.js","lineNumber":478,"sourceCode":"\t\t\t\t\tyield chunk;\n\t\t\t\t}\n\t\t\t\tif (cursor < size) throw new Error('incomplete file data');\n\t\t\t})()\n\t\t);\n\t}\n\tasync text() {\n\t\treturn text_decoder.decode(await this.arrayBuffer());\n\t}\n}\n\nconst path_regex = /^[a-zA-Z_$]\\w*(\\.[a-zA-Z_$]\\w*|\\[\\d+\\])*$/;\n\n/**\n * @param {string} path\n */\nexport function split_path(path) {\n\tif (!path_regex.test(path)) {\n\t\tthrow new Error(\n\t\t\t`Invalid field name ${path}` +\n\t\t\t\t(DEV\n\t\t\t\t\t? ': field names are written in JS object notation, so keys that would need quoting are not supported. See https://svelte.dev/docs/kit/remote-functions#form-Fields'\n\t\t\t\t\t: '')\n\t\t);\n\t}\n\n\treturn path.split(/\\.|\\[|\\]/).filter(Boolean);\n}\n\n/**\n * Check if a property key is dangerous and could lead to prototype pollution\n * @param {string} key\n */\nfunction check_prototype_pollution(key) {\n\tif (key === '__proto__' || key === 'constructor' || key === 'prototype') {\n\t\tthrow new Error(\n\t\t\t`Invalid key \"${key}\"` +","sourceCodeStart":460,"sourceCodeEnd":496,"githubUrl":"https://github.com/sveltejs/kit/blob/03f1687fe612ce3d2d9131139b5b188d9cf90c64/packages/kit/src/runtime/form-utils.js#L460-L496","documentation":"Form field names are used as paths into the submitted data object and are interpreted as JS object notation (dot/bracket paths like a.b[0].c). Keys that would need quoting (spaces, dashes, special characters) cannot be represented, so split_path rejects them; in dev the message includes the docs link.","triggerScenarios":"Creating a field whose name contains characters outside the allowed path grammar, e.g. form.fields.as('my-field'), 'user name', or keys starting with digits/brackets that fail path_regex.","commonSituations":"Using database column names with dashes/spaces as field names; names with non-ASCII characters; auto-generating names from arbitrary labels.","solutions":["Rename the field to a valid identifier path (letters, digits, underscores, dots, numeric indices).","Map external names (e.g. 'my-field') to valid field names and translate them server-side after parsing.","Sanitize generated names (slugify + identifier-safe transform) before passing them to form.fields.as."],"exampleFix":"// before\nfields.as('shipping-address');\n// after\nfields.as('shippingAddress');","handlingStrategy":"validation","validationCode":"const PATH_RE = /^[A-Za-z_$][\\w$]*(\\.[A-Za-z_$][\\w$]*|\\[\\d+\\])*$/;\nif (!PATH_RE.test(name)) throw new Error(`field name must be valid JS object notation: ${name}`);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use identifier-safe camelCase names for all form fields.","Slugify/sanitize any name derived from user-visible labels or DB columns.","Map external names to safe field names server-side after parsing."],"tags":["forms","naming","validation"],"backgroundTag":"invalid-field-name","analyzedSha":"03f1687fe612ce3d2d9131139b5b188d9cf90c64","analyzedAt":"2026-09-02T02:01:50.504Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}